{"id":108554,"date":"2023-05-17T00:48:11","date_gmt":"2023-05-16T22:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=108554"},"modified":"2023-05-17T10:40:17","modified_gmt":"2023-05-17T08:40:17","slug":"ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","title":{"rendered":"PMFault r\u00fcnnak, mis v\u00f5ib teatud serveris\u00fcsteemides CPU rikkuvat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Birmingham \u00fclikooli teadlased, kes on tuntud Plundervolt ja VoltPillager r\u00fcnnakute arendamise poolest, avastasid mitmetes serveri emaplaatides haavatavuse (CVE-2022-43309), mis v\u00f5imaldab f\u00fc\u00fcsiliselt rikku CPU-d, mille k\u00e4igus ei ole selle hilisem taastamine v\u00f5imalik. Haavatavust, mille koodnimi on PMFault, saab kasutada serverite kahjustamiseks, millele r\u00fcndajal ei ole f\u00fc\u00fcsilist juurdep\u00e4\u00e4su, kuid kellel on privileege operatsioonis\u00fcsteemis, saadud n\u00e4iteks parandamata haavatavuse \u00e4rakasutamise v\u00f5i administraatori paroolide tabamise kaudu. <\/p>\n

T\u00e4pne meetodi olemus seisneb PMBus-liidese kasutamises, milles kasutatakse I2C protokolli, et t\u00f5sta protsessorile antava pinget tasemeni, mis v\u00f5ib p\u00f5hjustada chipi kahjustamist. PMBus-liidest rakendatakse tavaliselt VRM (Voltage Regulator Module) moodulis, millele on v\u00f5imalik juurdep\u00e4\u00e4s BMC-kontrolleri manipuleerimise kaudu. PMBus-i toetavate emaplaatide r\u00fcndamiseks on lisaks operatsioonis\u00fcsteemis administraatori \u00f5igustele vajalik ka tarkvaraline juurdep\u00e4\u00e4s BMC-le (Baseboard Management Controller), n\u00e4iteks IPMI KCS (Keyboard Controller Style) liidese kaudu, Etherneti kaudu v\u00f5i BMC uuendamise kaudu praegusest s\u00fcsteemist. <\/p>\n

Probleem, mis v\u00f5imaldab r\u00fcnnata teadmata BMC autentimist, on kinnitatud Supermicro emaplaatidel, mis toetavad IPMI (X11, X12, H11 ja H12) ja ASRock, kuid haavatavuse all kannatavad ka teised serveriplatvormid, millele p\u00e4\u00e4seb ligi PMBus-ile. Katsete k\u00e4igus kahjustati nende plaatide peal kahe Intel Xeon protsessoriga, kui pinget t\u00f5steti 2,84 volti. BMC-le juurdep\u00e4\u00e4su saamiseks ilma autentimisandmete teadmiseta, kuid root-\u00f5igustega operatsioonis\u00fcsteemis, kasutati haavatavust p\u00fcsivara kontrollimise mehhanismis, mis v\u00f5imaldas laadida BMC-kontrollerisse muudetud p\u00fcsivara uuenduse, ning ka mitteautentimise kaudu IPMI KCS kaudu. <\/p>\n

PMBus'i kaudu pinget muutmise meetodit saab kasutada ka Plundervolt'i r\u00fcnnaku l\u00e4biviimiseks, mis v\u00f5imaldab minimaalsete pingete v\u00e4hendamise kaudu kahjustada CPU andmerakkude sisu, mis on kasutusel Intel SGX'is eraldatud anklavites, ning genereerida vigu algselt korrektsetes algoritmides. N\u00e4iteks, kui suudetakse muuta v\u00e4\u00e4rtust, mida kasutatakse kr\u00fcpteerimise k\u00e4igus korrutamiseks, on v\u00e4ljundiks vale kr\u00fcptotekst. R\u00fcndajal on v\u00f5imalus p\u00f6\u00f6rduda SGX-i t\u00f6\u00f6tleja poole oma andmete kr\u00fcpteerimiseks, tekitades t\u00f5rkeid, ning koguda statistikat kr\u00fcptoteksti muutumise kohta v\u00e4ljundis ning taastada kahe SGX anklavis hoitava v\u00f5tme v\u00e4\u00e4rtus. <\/p>\n

R\u00fcnnaku t\u00f6\u00f6riistad Supermicro ja ASRock emaplaatide vastu ning utiliit PMBus'i ligip\u00e4\u00e4su kontrollimiseks on avaldatud GitHub'is.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PMFault, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0435\u0442 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 PMFault r\u00fcnnak, mis v\u00f5imaldab m\u00f5ningates serveris\u00fcsteemides CPU h\u00e4vitada | ProHoster","description":"Birmingham'i \u00fclikooli teadlased, kes olid varem tuntud Plundervolt ja VoltPillager r\u00fcnnakute arendamise poolest, tuvastasid haavatavuse (CVE-2022-43309) m\u00f5nedes serveri emaplaatides, mis v\u00f5imaldab f\u00fc\u00fcsilist v\u00e4ljaviimist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 PMFault, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-05-16T22:48:11+00:00","article:modified_time":"2023-05-17T08:40:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}